1/* $NetBSD: ldapmap.c,v 1.3 2021/08/14 16:14:58 christos Exp $ */ 2 3/* $OpenLDAP$ */ 4/* This work is part of OpenLDAP Software <http://www.openldap.org/>. 5 * 6 * Copyright 2000-2021 The OpenLDAP Foundation. 7 * All rights reserved. 8 * 9 * Redistribution and use in source and binary forms, with or without 10 * modification, are permitted only as authorized by the OpenLDAP 11 * Public License. 12 * 13 * A copy of this license is available in the file LICENSE in the 14 * top-level directory of the distribution or, alternatively, at 15 * <http://www.OpenLDAP.org/license.html>. 16 */ 17/* ACKNOWLEDGEMENT: 18 * This work was initially developed by Pierangelo Masarati for 19 * inclusion in OpenLDAP Software. 20 */ 21 22#include <portable.h> 23 24#define LDAP_DEPRECATED 1 25#include "rewrite-int.h" 26#include "rewrite-map.h" 27 28typedef enum { 29 MAP_LDAP_UNKNOWN, 30 MAP_LDAP_EVERYTIME, 31 MAP_LDAP_NOW, 32 MAP_LDAP_LATER 33} bindwhen_t; 34 35/* 36 * LDAP map data structure 37 */ 38struct ldap_map_data { 39 char *lm_url; 40 LDAPURLDesc *lm_lud; 41 int lm_version; 42 char *lm_binddn; 43 struct berval lm_cred; 44 45 bindwhen_t lm_when; 46 47 LDAP *lm_ld; 48 49 int lm_wantdn; 50 char *lm_attrs[ 2 ]; 51 52#ifdef USE_REWRITE_LDAP_PVT_THREADS 53 ldap_pvt_thread_mutex_t lm_mutex; 54#endif /* USE_REWRITE_LDAP_PVT_THREADS */ 55}; 56 57static void 58map_ldap_free( 59 struct ldap_map_data *data 60) 61{ 62 assert( data != NULL ); 63 64 if ( data->lm_url != NULL ) { 65 free( data->lm_url ); 66 } 67 68 if ( data->lm_lud != NULL ) { 69 ldap_free_urldesc( data->lm_lud ); 70 } 71 72 if ( data->lm_binddn != NULL ) { 73 free( data->lm_binddn ); 74 } 75 76 if ( data->lm_cred.bv_val != NULL ) { 77 memset( data->lm_cred.bv_val, 0, data->lm_cred.bv_len ); 78 free( data->lm_cred.bv_val ); 79 data->lm_cred.bv_val = NULL; 80 data->lm_cred.bv_len = 0; 81 } 82 83 if ( data->lm_when != MAP_LDAP_EVERYTIME && data->lm_ld != NULL ) { 84 ldap_unbind_ext( data->lm_ld, NULL, NULL ); 85 } 86 87 free( data ); 88} 89 90static void * 91map_ldap_parse( 92 const char *fname, 93 int lineno, 94 int argc, 95 char **argv 96) 97{ 98 struct ldap_map_data *data; 99 char *p, *uri; 100 101 assert( fname != NULL ); 102 assert( argv != NULL ); 103 104 data = calloc( sizeof( struct ldap_map_data ), 1 ); 105 if ( data == NULL ) { 106 return NULL; 107 } 108 109 if ( argc < 1 ) { 110 Debug( LDAP_DEBUG_ANY, 111 "[%s:%d] ldap map needs URI\n", 112 fname, lineno ); 113 free( data ); 114 return NULL; 115 } 116 117 uri = argv[ 0 ]; 118 if ( strncasecmp( uri, "uri=", STRLENOF( "uri=" ) ) == 0 ) { 119 uri += STRLENOF( "uri=" ); 120 } 121 122 data->lm_url = strdup( uri ); 123 if ( data->lm_url == NULL ) { 124 map_ldap_free( data ); 125 return NULL; 126 } 127 128 if ( ldap_url_parse( uri, &data->lm_lud ) != REWRITE_SUCCESS ) { 129 Debug( LDAP_DEBUG_ANY, 130 "[%s:%d] illegal URI '%s'\n", 131 fname, lineno, argv[ 0 ] ); 132 map_ldap_free( data ); 133 return NULL; 134 } 135 136 /* trim everything after [host][:port] */ 137 p = strchr( data->lm_url, '/' ); 138 assert( p[ 1 ] == '/' ); 139 if ( ( p = strchr( p + 2, '/' ) ) != NULL ) { 140 p[ 0 ] = '\0'; 141 } 142 143 if ( data->lm_lud->lud_attrs == NULL ) { 144 data->lm_attrs[ 0 ] = LDAP_NO_ATTRS; 145 data->lm_wantdn = 1; 146 147 } else { 148 if ( data->lm_lud->lud_attrs[ 1 ] != NULL ) { 149 Debug( LDAP_DEBUG_ANY, 150 "[%s:%d] only one attribute allowed in URI\n", 151 fname, lineno ); 152 map_ldap_free( data ); 153 return NULL; 154 } 155 156 if ( strcasecmp( data->lm_lud->lud_attrs[ 0 ], "dn" ) == 0 157 || strcasecmp( data->lm_lud->lud_attrs[ 0 ], "entryDN" ) == 0 ) 158 { 159 ldap_memfree( data->lm_lud->lud_attrs[ 0 ] ); 160 ldap_memfree( data->lm_lud->lud_attrs ); 161 data->lm_lud->lud_attrs = NULL; 162 data->lm_attrs[ 0 ] = LDAP_NO_ATTRS; 163 data->lm_wantdn = 1; 164 165 } else { 166 data->lm_attrs[ 0 ] = data->lm_lud->lud_attrs[ 0 ]; 167 } 168 } 169 170 data->lm_attrs[ 1 ] = NULL; 171 172 /* safe defaults */ 173 data->lm_version = LDAP_VERSION3; 174 175 for ( argc--, argv++; argc > 0; argc--, argv++ ) { 176 if ( strncasecmp( argv[ 0 ], "binddn=", STRLENOF( "binddn=" ) ) == 0 ) { 177 char *p = argv[ 0 ] + STRLENOF( "binddn=" ); 178 int l; 179 180 if ( p[ 0 ] == '\"' || p [ 0 ] == '\'' ) { 181 l = strlen( p ) - 2; 182 p++; 183 if ( p[ l ] != p[ 0 ] ) { 184 map_ldap_free( data ); 185 return NULL; 186 } 187 } else { 188 l = strlen( p ); 189 } 190 191 data->lm_binddn = strdup( p ); 192 if ( data->lm_binddn == NULL ) { 193 map_ldap_free( data ); 194 return NULL; 195 } 196 197 if ( data->lm_binddn[ l ] == '\"' 198 || data->lm_binddn[ l ] == '\'' ) { 199 data->lm_binddn[ l ] = '\0'; 200 } 201 202 /* deprecated */ 203 } else if ( strncasecmp( argv[ 0 ], "bindpw=", STRLENOF( "bindpw=" ) ) == 0 ) { 204 ber_str2bv( argv[ 0 ] + STRLENOF( "bindpw=" ), 0, 1, &data->lm_cred ); 205 if ( data->lm_cred.bv_val == NULL ) { 206 map_ldap_free( data ); 207 return NULL; 208 } 209 210 } else if ( strncasecmp( argv[ 0 ], "credentials=", STRLENOF( "credentials=" ) ) == 0 ) { 211 ber_str2bv( argv[ 0 ] + STRLENOF( "credentials=" ), 0, 1, &data->lm_cred ); 212 if ( data->lm_cred.bv_val == NULL ) { 213 map_ldap_free( data ); 214 return NULL; 215 } 216 217 } else if ( strncasecmp( argv[ 0 ], "bindwhen=", STRLENOF( "bindwhen=" ) ) == 0 ) { 218 char *p = argv[ 0 ] + STRLENOF( "bindwhen=" ); 219 220 if ( strcasecmp( p, "now" ) == 0 ) { 221 int rc; 222 223 data->lm_when = MAP_LDAP_NOW; 224 225 /* 226 * Init LDAP handler ... 227 */ 228 rc = ldap_initialize( &data->lm_ld, data->lm_url ); 229 if ( rc != LDAP_SUCCESS ) { 230 map_ldap_free( data ); 231 return NULL; 232 } 233 234 ldap_set_option( data->lm_ld, 235 LDAP_OPT_PROTOCOL_VERSION, 236 (void *)&data->lm_version ); 237 238#ifdef USE_REWRITE_LDAP_PVT_THREADS 239 ldap_pvt_thread_mutex_init( &data->lm_mutex ); 240#endif /* USE_REWRITE_LDAP_PVT_THREADS */ 241 242 } else if ( strcasecmp( p, "later" ) == 0 ) { 243 data->lm_when = MAP_LDAP_LATER; 244 245#ifdef USE_REWRITE_LDAP_PVT_THREADS 246 ldap_pvt_thread_mutex_init( &data->lm_mutex ); 247#endif /* USE_REWRITE_LDAP_PVT_THREADS */ 248 249 } else if ( strcasecmp( p, "everytime" ) == 0 ) { 250 data->lm_when = MAP_LDAP_EVERYTIME; 251 } else { 252 /* ignore ... */ 253 } 254 255 } else if ( strncasecmp( argv[ 0 ], "version=", STRLENOF( "version=" ) ) == 0 ) { 256 if ( lutil_atoi( &data->lm_version, argv[ 0 ] + STRLENOF( "version=" ) ) ) { 257 map_ldap_free( data ); 258 return NULL; 259 } 260 261 switch ( data->lm_version ) { 262 case LDAP_VERSION2: 263 case LDAP_VERSION3: 264 break; 265 266 default: 267 Debug( LDAP_DEBUG_ANY, 268 "[%s:%d] unknown version %s\n", 269 fname, lineno, p ); 270 map_ldap_free( data ); 271 return NULL; 272 } 273 274 } else { 275 Debug( LDAP_DEBUG_ANY, 276 "[%s:%d] unknown option %s (ignored)\n", 277 fname, lineno, argv[0] ); 278 } 279 } 280 281 if ( data->lm_when == MAP_LDAP_UNKNOWN ) { 282 data->lm_when = MAP_LDAP_EVERYTIME; 283 } 284 285 return ( void * )data; 286} 287 288static int 289map_ldap_apply( 290 void *private, 291 const char *filter, 292 struct berval *val 293 294) 295{ 296 LDAP *ld; 297 LDAPMessage *res = NULL, *entry; 298 int rc; 299 struct ldap_map_data *data = private; 300 LDAPURLDesc *lud = data->lm_lud; 301 302 int first_try = 1, set_version = 0; 303 304 assert( private != NULL ); 305 assert( filter != NULL ); 306 assert( val != NULL ); 307 308 val->bv_val = NULL; 309 val->bv_len = 0; 310 311 if ( data->lm_when == MAP_LDAP_EVERYTIME ) { 312 rc = ldap_initialize( &ld, data->lm_url ); 313 set_version = 1; 314 315 } else { 316#ifdef USE_REWRITE_LDAP_PVT_THREADS 317 ldap_pvt_thread_mutex_lock( &data->lm_mutex ); 318#endif /* USE_REWRITE_LDAP_PVT_THREADS */ 319 320 rc = LDAP_SUCCESS; 321 322 if ( data->lm_when == MAP_LDAP_LATER && data->lm_ld == NULL ) { 323 rc = ldap_initialize( &data->lm_ld, data->lm_url ); 324 set_version = 1; 325 } 326 327 ld = data->lm_ld; 328 } 329 330 if ( rc != LDAP_SUCCESS ) { 331 rc = REWRITE_ERR; 332 goto rc_return; 333 } 334 335do_bind:; 336 if ( set_version ) { 337 ldap_set_option( ld, LDAP_OPT_PROTOCOL_VERSION, 338 (void *)&data->lm_version ); 339 set_version = 0; 340 } 341 342 if ( data->lm_binddn != NULL ) { 343 rc = ldap_sasl_bind_s( ld, data->lm_binddn, 344 LDAP_SASL_SIMPLE, &data->lm_cred, 345 NULL, NULL, NULL ); 346 if ( rc == LDAP_SERVER_DOWN && first_try ) { 347 first_try = 0; 348 if ( ldap_initialize( &ld, data->lm_url ) != LDAP_SUCCESS ) { 349 rc = REWRITE_ERR; 350 goto rc_return; 351 } 352 set_version = 1; 353 goto do_bind; 354 355 } else if ( rc != REWRITE_SUCCESS ) { 356 rc = REWRITE_ERR; 357 goto rc_return; 358 } 359 } 360 361 rc = ldap_search_ext_s( ld, lud->lud_dn, lud->lud_scope, ( char * )filter, 362 data->lm_attrs, 0, NULL, NULL, NULL, 1, &res ); 363 if ( rc == LDAP_SERVER_DOWN && first_try ) { 364 first_try = 0; 365 if ( ldap_initialize( &ld, data->lm_url ) != LDAP_SUCCESS ) { 366 rc = REWRITE_ERR; 367 goto rc_return; 368 } 369 set_version = 1; 370 goto do_bind; 371 372 } else if ( rc != LDAP_SUCCESS ) { 373 rc = REWRITE_ERR; 374 goto rc_return; 375 } 376 377 if ( ldap_count_entries( ld, res ) != 1 ) { 378 ldap_msgfree( res ); 379 rc = REWRITE_ERR; 380 goto rc_return; 381 } 382 383 entry = ldap_first_entry( ld, res ); 384 assert( entry != NULL ); 385 386 if ( data->lm_wantdn == 1 ) { 387 /* 388 * dn is newly allocated, so there's no need to strdup it 389 */ 390 val->bv_val = ldap_get_dn( ld, entry ); 391 val->bv_len = strlen( val->bv_val ); 392 393 } else { 394 struct berval **values; 395 396 values = ldap_get_values_len( ld, entry, data->lm_attrs[ 0 ] ); 397 if ( values != NULL ) { 398 if ( values[ 0 ] != NULL && values[ 0 ]->bv_val != NULL ) { 399#if 0 400 /* NOTE: in principle, multiple values 401 * should not be acceptable according 402 * to the current API; ignore by now */ 403 if ( values[ 1 ] != NULL ) { 404 /* error */ 405 } 406#endif 407 ber_dupbv( val, values[ 0 ] ); 408 } 409 ldap_value_free_len( values ); 410 } 411 } 412 413 ldap_msgfree( res ); 414 415 if ( val->bv_val == NULL ) { 416 rc = REWRITE_ERR; 417 goto rc_return; 418 } 419 420rc_return:; 421 if ( data->lm_when == MAP_LDAP_EVERYTIME ) { 422 if ( ld != NULL ) { 423 ldap_unbind_ext( ld, NULL, NULL ); 424 } 425 426 } else { 427 data->lm_ld = ld; 428#ifdef USE_REWRITE_LDAP_PVT_THREADS 429 ldap_pvt_thread_mutex_unlock( &data->lm_mutex ); 430#endif /* USE_REWRITE_LDAP_PVT_THREADS */ 431 } 432 433 return rc; 434} 435 436static int 437map_ldap_destroy( 438 void *private 439) 440{ 441 struct ldap_map_data *data = private; 442 443 assert( private != NULL ); 444 445 map_ldap_free( data ); 446 447 return 0; 448} 449 450const rewrite_mapper rewrite_ldap_mapper = { 451 "ldap", 452 map_ldap_parse, 453 map_ldap_apply, 454 map_ldap_destroy 455}; 456 457